Setting up WireGuard for your own VPN

You can run your own VPN on a Hostworld VPS with WireGuard. The VPS acts as a small gateway you control, with your phone and laptop connecting using their own keys. You choose whether all traffic uses the VPN or only specific networks.

This picks up from a server you can already reach over SSH.

Before you start

• Have your Hostworld VPS running AlmaLinux 9 or Ubuntu 24.04. Keep the Virtualizor VNC console handy in case you lock yourself out while changing networking. You reach Virtualizor from the Hostworld client area.
• Decide a UDP port for WireGuard. 51820/udp is common, but you can use any unused UDP port. You will open this in the firewall.
• Pick a tunnel subnet that does not conflict with anything you already use. 10.90.90.0/24 is used below as an example. If it overlaps your home or office LAN, routing will fail.
• Plan your routing. A “full tunnel” sends all client traffic through the VPS. A “split tunnel” sends only some destinations through the VPS.
• Smartphones use the official WireGuard apps for Android and iOS. You can import a client configuration via a QR code.
• Be aware of what a personal VPN does. Traffic is encrypted between your device and your VPS. After that, it exits to the internet from your VPS IP. This does not make you anonymous.
• Risk management. Changing firewall rules or turning on a misconfigured full tunnel can drop your SSH session. Open the Virtualizor VNC console first so you have out‑of‑band access if needed.

Step 1: Install WireGuard tools

This installs WireGuard and its userland tools so you have the wg and wg-quick commands.

Ubuntu 24.04

sudo apt update
sudo apt install wireguard wireguard-tools

AlmaLinux 9

sudo dnf install -y wireguard-tools

On both Ubuntu 24.04 and AlmaLinux 9, WireGuard is in the kernel already. You only need the userspace tools.

Step 2: Enable IPv4 forwarding on the server

This allows the VPS to forward packets from the VPN to the internet. It is required if you want clients to use the VPS as a gateway.

Create a sysctl configuration file that enables IPv4 forwarding permanently. You can reboot later to apply it.

Ubuntu 24.04 and AlmaLinux 9

echo 'net.ipv4.ip_forward=1' | sudo tee /etc/sysctl.d/99-wireguard-ipv4-forwarding.conf

Keep the Virtualizor VNC console ready before any reboot, so you do not lose access if something is misconfigured.

Step 3: Open the WireGuard UDP port

This allows inbound VPN packets to reach your VPS.

Ubuntu 24.04 using UFW

sudo ufw allow 51820/udp

If you chose a different port, replace 51820 with your port.

AlmaLinux 9 using firewalld

sudo firewall-cmd --permanent --add-port=51820/udp

If you chose a different port, replace 51820 with your port.

Step 4: Generate the server keys

This creates a server private key with restricted permissions and derives the matching public key. The umask keeps files readable only by root.

Ubuntu 24.04 and AlmaLinux 9

sudo su -c 'umask 077; wg genkey > /etc/wireguard/wg0.key'
sudo su -c 'wg pubkey < /etc/wireguard/wg0.key > /etc/wireguard/wg0.pub'

Step 5: Create the server configuration

This defines the WireGuard interface, its tunnel address, listening port and how to load the private key at start. It keeps the private key out of the world‑readable config file.

Ubuntu 24.04 and AlmaLinux 9

sudo tee /etc/wireguard/wg0.conf > /dev/null <<'EOF'
[Interface]
Address = 10.90.90.1/24
ListenPort = 51820
# Load the private key from a root-only file on bring-up:
PostUp = wg set %i private-key /etc/wireguard/%i.key
EOF

Do not add SaveConfig=true. If you do, wg-quick can overwrite your file on shutdown with the live state, which can remove comments or edits you have not saved elsewhere.

Step 6: Bring up and enable the server interface

This starts the WireGuard interface now and enables start on boot.

Ubuntu 24.04 and AlmaLinux 9

sudo wg-quick up wg0
sudo systemctl enable wg-quick@wg0

Step 7: Add your phone as a full‑tunnel client

This creates a client keypair and a client configuration that sends all traffic through the VPS. The configuration is suitable for import into the official WireGuard app via QR code. PrivateKey must be inline for QR import.

On the VPS: generate the phone keys

This generates a keypair for the phone with restricted permissions while you prepare the config.

umask 077; wg genkey > ~/phone.key
wg pubkey < ~/phone.key > ~/phone.pub

On the VPS: write the phone client config

This writes a client file that uses the VPS as the default gateway. Replace YOUR.SERVER.IP.OR.NAME with your VPS public IP or DNS name. If your server port is not 51820, change it.

SERVER_PUB=$(sudo cat /etc/wireguard/wg0.pub)
PHONE_PRIV=$(cat ~/phone.key)
cat > ~/phone.conf <<EOF
[Interface]
Address = 10.90.90.2/32
PrivateKey = ${PHONE_PRIV}

[Peer]
PublicKey = ${SERVER_PUB}
Endpoint = YOUR.SERVER.IP.OR.NAME:51820
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25
EOF

AllowedIPs = 0.0.0.0/0 makes this a full tunnel. PersistentKeepalive helps phones behind NAT receive traffic.

On the VPS: add the phone as a peer on the server

This appends the phone’s public key to the server config and allows it to use its assigned address. Then it reloads the interface to apply peer changes without dropping the tunnel.

PHONE_PUB=$(cat ~/phone.pub)
sudo tee -a /etc/wireguard/wg0.conf > /dev/null <<EOF
[Peer]
# Phone
PublicKey = ${PHONE_PUB}
AllowedIPs = 10.90.90.2/32
EOF
sudo systemctl reload wg-quick@wg0

Import to the WireGuard app

This shows a terminal QR code you can scan from the WireGuard app on your phone. PrivateKey is inline in the file which the app requires for QR import.

qrencode -t ansiutf8 < ~/phone.conf

Open the WireGuard app on your phone, choose to add a tunnel from QR code, scan it, then activate the tunnel.

After you have imported the config, consider deleting ~/phone.key and ~/phone.conf from the server.

Step 8: Add your laptop as a split‑tunnel client

This creates a laptop client that only routes specific networks over the VPN. The example limits routing to the VPN subnet. Internet‑bound traffic continues to use the laptop’s normal connection.

On the VPS: generate the laptop keys

This creates a keypair for the laptop with restricted permissions while you prepare the config.

umask 077; wg genkey > ~/laptop.key
wg pubkey < ~/laptop.key > ~/laptop.pub

On the VPS: write the laptop client config

This writes a client file that sends only the VPN subnet through the tunnel. It also sets DNS correctly on Ubuntu laptops using systemd‑resolved when the tunnel comes up.

LAPTOP_PRIV=$(cat ~/laptop.key)
cat > ~/laptop.conf <<EOF
[Interface]
Address = 10.90.90.3/32
PrivateKey = ${LAPTOP_PRIV}
# For Ubuntu 24.04 clients using systemd-resolved, set DNS on bring-up:
PostUp = resolvectl dns %i 1.1.1.1
PostUp = resolvectl domain %i ~.
PostDown = resolvectl revert %i

[Peer]
PublicKey = ${SERVER_PUB}
Endpoint = YOUR.SERVER.IP.OR.NAME:51820
AllowedIPs = 10.90.90.0/24
# If your laptop is behind NAT and must receive unsolicited packets:
PersistentKeepalive = 25
EOF

Replace the DNS resolver with one you prefer. The DNS lines are shown for Ubuntu 24.04 clients because the DNS= field in wg-quick relies on resolvconf, which Ubuntu does not use by default. The resolvectl calls configure DNS correctly.

On the VPS: add the laptop as a peer on the server

This appends the laptop’s public key to the server config and allows it to use its assigned address. Then it reloads the interface to apply peer changes without dropping the tunnel.

LAPTOP_PUB=$(cat ~/laptop.pub)
sudo tee -a /etc/wireguard/wg0.conf > /dev/null <<EOF
[Peer]
# Laptop
PublicKey = ${LAPTOP_PUB}
AllowedIPs = 10.90.90.3/32
EOF
sudo systemctl reload wg-quick@wg0

Copy ~/laptop.conf to your laptop and import it with wg-quick or the WireGuard desktop app. On Linux laptops, place it at /etc/wireguard/wg0.conf and run wg-quick up wg0.

Step 9: Choose full tunnel or split tunnel and understand AllowedIPs

WireGuard uses a model called “cryptokey routing”. Each peer’s public key is associated with the IP addresses it is allowed to use. That list is the peer’s AllowedIPs. This doubles as routing and as access control.

• Full tunnel: set AllowedIPs = 0.0.0.0/0 in the client config. Your client will send all traffic through the VPN. wg-quick adds policy routing automatically to avoid deadlock when default routes change.
• Split tunnel: put only the internal networks you want over the VPN in AllowedIPs, for example 10.90.90.0/24 or a list like 10.10.11.0/24,10.10.10.0/24.

On the server, each [Peer] block’s AllowedIPs defines what source addresses that peer may use. If a peer tries to use an address you did not allow, the server will drop it.

Step 10: Enable NAT so clients can reach the internet

This sets up source NAT on the VPS so client traffic can be forwarded out to the internet. You only need this if clients should use the VPS as a gateway.

Ubuntu 24.04

This adds a MASQUERADE rule for the VPN subnet leaving via eth0.

sudo iptables -t nat -A POSTROUTING -s 10.90.90.0/24 -o eth0 -j MASQUERADE

This iptables rule is not persistent across reboots. Plan how you will re‑apply it after a restart, or manage it within your configuration once you are comfortable with the order of firewall rules on your system.

AlmaLinux 9

This enables masquerading in firewalld, which performs the NAT for forwarded traffic.

sudo firewall-cmd --permanent --add-masquerade

Because the rule is permanent, it will survive reboots.

Step 11: Add an optional preshared key for extra hardening

This adds a symmetric preshared key on top of the standard public‑key crypto. You must add the same preshared key to both the server’s [Peer] and the client’s [Peer] blocks.

wg genpsk > ~/psk

Then add a line like PresharedKey = <contents of ~/psk> in both sides’ [Peer] blocks for that client, and reload the server with:

sudo systemctl reload wg-quick@wg0

Step 12: Verify and operate safely

• To update peers on the server without dropping the interface, edit /etc/wireguard/wg0.conf then run sudo systemctl reload wg-quick@wg0. Changing Address or PostUp requires a restart with sudo wg-quick down wg0 then sudo wg-quick up wg0.
• If a client connects but cannot reach the internet, check that IPv4 forwarding is enabled and that NAT is in place on the server.
• If you get stuck, open the open a support ticket and we will help. Mention whether you used full or split tunnel and include the relevant config blocks without your private keys.

What next

• Run your WireGuard VPN on a fast VPS close to you. See our Linux VPS plans in London and in New York.
• Browse more topics in our VPS guides, including firewall management and secure remote access.
• If you are working on a Hostworld VPS and need to recover access after a firewall change, use the VNC console in Virtualizor from your client area. If you need help, open a support ticket.